Your data, on the record.

One account per person, across every FireFront app. You can create it yourself with an email address you verify, or accept an invitation from a company. Your name, email address, role and rank identify you to your company and crewmates and secure access to the services. Your account is yours: leaving a company keeps it, along with your certificates, qualifications and history.

Command additionally holds what a contractor needs to crew and pay you: contact details and address, pay rate, certificates and the files you upload, qualifications and task books, incidents and assignments, timesheets, shift tickets, and — if a company runs its hiring through FireFront — onboarding answers, which may include Social Security numbers. Those answers are encrypted at rest and every time a person views one it is logged.

Location. Location is the core of FireFront Maps. With your permission, we collect your device's precise position while you use the app — to show you on the map, tag weather reports, and place markers. If you start a track recording (“Track Me”) or share your live position in a map session, the app continues collecting GPS positions while it is in the background or your screen is off. iOS shows a visible indicator whenever this is active, and it only starts when you explicitly start it.

Content you create. Map markers and drawings, recorded GPS tracks, weather observations, uploaded map files (e.g. GeoPDFs), session names, and similar operational content.

Medical alerts. Triggering the one-tap medical alert sends your identity, position, and alert details to the other participants in your map session so they can respond. This feature is always initiated by you.

Phone number (optional). Within a map session you may choose to share your phone number with other participants so they can call you. Off by default, controlled per session.

Push tokens & diagnostics. If you enable notifications, we store a device push token to deliver alerts. Crash reports and error diagnostics (via Sentry) may include device model, OS version, and app state at the time of a crash. Basic device and app-version info supports troubleshooting and update notices.

Map SDK telemetry. Our maps are powered by Mapbox, whose SDK may collect limited device and usage telemetry as described in the Mapbox privacy policy.

We use this information to operate the services: rendering maps, sharing positions and observations within your crew, delivering alerts and notifications, maintaining incident records, troubleshooting problems, and keeping the services secure.

We do not use your information for advertising. We do not sell your information. We do not track you across other companies' apps or websites.

Your session participants. Your live position (while sharing), tracks, markers, weather reports, medical alerts, and — if you opt in — your phone number are visible to the other participants of the map sessions you join.

Your organization. Owners and administrators of your company can see operational records associated with your account.

Service providers. We use infrastructure providers to run the services: Railway (hosting and database), Cloudflare (networking and file storage), Mapbox (map rendering), Expo (push notification delivery), and Sentry (crash reporting). They process data on our behalf and may not use it for their own purposes, except as described in their own policies for the telemetry noted above.

Legal requirements. We may disclose information if required by law or to protect the safety of users or the public.

A contractor is required by law to keep payroll records. When you work for a company on FireFront, that company holds the employer's copy of your timesheets, approvals, rate history, shift tickets and the certificates it relied on to crew you. Those stay in the company's books for four years after your last pay period (matching federal tax and wage-record rules), whether you leave, pause or delete your account.

If you delete your account, those records are attached to an anonymous "Former employee" entry — never your name, email, phone or address — and are purged when the four years are up. Incidents, assignments and who crewed which rig remain part of the company's incident history.

You can download a full copy of everything FireFront holds about you at any time from Settings → Account → Download my records: a zip with a spreadsheet and data file per section and every original file.

You control location sharing:

• Location permissions can be granted or revoked at any time in your device settings.
• Live position sharing within a session can be turned off at any time in the app.
• Track recording starts and stops only at your direction.

Operational records (sessions, tracks, markers, reports, incident data) are retained as part of your organization's incident history, which crews rely on for after-action review and record-keeping. Your organization controls how long its records are kept.

All communication between the app and our servers is encrypted in transit using HTTPS/TLS. Authentication uses industry-standard signed tokens, stored in your device's secure storage. Access to operational data is restricted by role and by session membership.

Permissions: control location and notification access in your device settings at any time.

Sessions: leave any map session at any time; leaving removes your position from the session map.

Access, correction, download: edit your profile in Settings, and download everything from Settings → Account at any time. To correct something your employer recorded, ask them; to reach us directly, use the address below.

Pause: Settings → Account → Pause my account stops sign-in, alerts and location sharing and removes nothing. Sign back in with your password and an emailed code.

Depending on where you live, you may have additional rights under local law (such as the CCPA for California residents). Contact us to exercise them.

Delete from Settings → Account in the Command app (web or phone), or without the app at firefront.dev/delete-account. Either way you re-enter your password, enter a code we email you and confirm that your certificates and fire history will be permanently removed.

Deletion runs 14 days later. Signing in to any FireFront app before then cancels it. When it runs, your profile, contact details, certificates and files, qualifications, task books, fire and employment history, Echo posts and messages and your own documents are removed. Maps sessions you created pass to their oldest co-editor. What remains is the employer's payroll record described above, under an anonymous entry, for its retention period.

The owner of a company with other members must hand the company to a co-owner or close it before deleting their own account. A company that closes waits 30 days, during which nothing new can be entered; every member keeps their own account and records.

Companies on FireFront can be marked verified. That label is never a stored checkbox: it is computed from evidence we record — a match against the public SAM.gov registration, the public federal dispatch priority list, a state business registry, or a concierge review — each with what was checked and when. A company can also be labelled unverified. We never overstate: a qualification a company confirms is shown as self-reported or documented accordingly.

The services are workplace tools intended for adult wildland firefighting personnel and are not directed to children under 13. We do not knowingly collect information from children.

We may update this policy from time to time. We will post the updated version at this address and update the effective date above. Material changes will be communicated through the services.

Questions or requests regarding this policy or your data:

[email protected]